Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

ironic-inspector

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2PyPIAmendedPublished

    Openstack ironic-inspector has SQL injection vulnerability in node_cache

    CVE-2019-10141 · GHSA-c7fc-cm7p-92r2

    Affected
    • PyPI ironic-inspector < 5.0.2; >= 5.1.0, < 6.0.3; >= 6.1.0, < 7.2.4; >= 8.0.0, < 8.0.3; >= 8.1.0, < 8.2.1
    Fixed in
    8.2.16.0.38.0.37.2.45.0.2· Vendor fix available
    Issue
    A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's nodecache.findnode(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service.

    Recommended action: Upgrade to 8.2.1, 8.0.3, 7.2.4 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Critical, CVSS 9.2PyPIAmendedPublished

    Injection vulnerability that affects ironic-discoverd

    CVE-2015-5306 · GHSA-x64g-wjmw-w328

    Affected
    • PyPI ironic-inspector < 2.2.2
    Fixed in
    2.2.2· Vendor fix available
    Issue
    OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.

    Recommended action: Upgrade to 2.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →